Next: , Previous: Customizing Builtin Policy, Up: Customizing Bro


7.5 Writing New Policy

For example, if your site only allows external http and mail to a small, controlled lists of hosts, you could write a new .bro file containing this:

const web_servers = { www.lbl.gov, www.bro-ids.org, };
const mail_servers = { smtp.lbl.gov, smtp2.lbl.gov, };

const allow_my_services: set[addr, port] = {
        [mail_servers, smtp],
        [web_servers, http],
};

Bro can then generate an Alarm or even terminate the connection for policy violations. For example:


event connection_established(c: connection)
{
   local id = c$id;
   local service = id$resp_p;
   local inbound = is_local_addr(id$resp_h);

   if ( inbound && [id$resp_h, service] !in allow_my_services )
      NOTICE ([$note=SensitiveConnection, $conn=c,
		$msg=fmt("hot: %s", full_id_string(c)) ]);
    if ( inbound && service in terminate_successful_inbound_service )
            terminate_connection(c);
}

To test this you might do the following. First, generate some "offline" data to play with:

      # tcpdump -s 0 -w trace.out port smtp or port http

Kill off the tcpdump after capturing traffic for a few minutes (use ctrl-C). Then add the above Bro code to your hostname.bro file, and run Bro against this captured trace file:

      # setenv BROHOME /usr/local/bro
      # setenv BROPATH $BROHOME/site:$BROHOME/policy
      # bro -r trace.out hostname.bro